Give an installed machine a way to catch up

./install only ever adds. It copies over /, links dotfiles, installs
packages -- and has no way to say "remove that file", "disable that
unit", "that symlink points nowhere now". So a machine set up months
ago keeps whatever this repository has since decided was wrong, and
the only thing that ever fixes it is somebody reading a commit
message. With a curl installer in the README, that stopped being
hypothetical.

A migration is one script that performs one repair, exactly once, on
the machines that need it. Named by the commit timestamp that authored
it, so glob order is chronological without a sequence number two
branches could both pick. Marked in ~/.local/state on success and only
on success, so a repair that failed stays pending rather than being
recorded as done and hidden forever. Ordered, and stopped at the first
failure, because a later repair may assume an earlier one landed. A
fresh install marks everything without running it, the way
Migrations.qml stamps a pre-versioning settings file at its baseline.

The first real one removes the dangling ~/.config/forge symlink left
behind when the GNOME session was cut: link-dotfiles could link it but
never unlink it. Verified both ways -- a no-op on a machine that never
had it, an actual repair on one that did.

Root work goes through panama-sudo --reason so the password prompt
names the repair, and the contract fails any migration reaching for
bare sudo.

config/dot/hypr/autostart.lua

@@ -39,6 +39,11 @@ hl.on("hyprland.start", function()
     -- prompt if Panama's ever fails to come up.
     hl.exec_cmd("systemctl --user import-environment WAYLAND_DISPLAY XDG_CURRENT_DESKTOP && systemctl --user start panama-polkit-agent.service hyprpaper.service vicinae.service hypridle.service")
 
+    -- Pending repairs for this machine, if any. Oneshot: it checks, tells the
+    -- user when there is something to tell, and exits. Started here rather
+    -- than enabled so it belongs to the Hyprland session; see the unit.
+    hl.exec_cmd("systemctl --user start panama-migrate-notify.service")
+
     -- Text expansion. change-settings runs `espanso service register`, which
     -- writes and enables espanso's own user unit; the explicit start makes the
     -- first Hyprland login after a fresh install work rather than the second.

config/local/share/systemd/user/panama-migrate-notify.service

@@ -0,0 +1,21 @@
+[Unit]
+Description=Tell the user when Panama has repairs waiting
+Documentation=https://github.com/gibbyb/Panama
+# Started per-session by hypr/autostart.lua rather than enabled globally, for
+# the same reason as every other Panama unit: graphical-session.target is
+# active under GNOME too, and a notification about the Hyprland desktop has no
+# business appearing in a GNOME session.
+
+[Service]
+Type=oneshot
+# Resolved at runtime rather than written as a literal path: ./install and the
+# stages honor an exported PANAMA_PATH, so a clone anywhere else still works.
+# The sibling units reach their scripts through ~/.config/quickshell, which is
+# a symlink link-dotfiles creates; bin/ has no such symlink.
+ExecStart=/usr/bin/env sh -c 'exec "${PANAMA_PATH:-$HOME/.local/share/Panama}/bin/panama-migrate-notify"'
+# The notification carries an action, so notify-send waits for the user to
+# click or dismiss it. Bounded so an ignored notification does not leave this
+# activating for the life of the session -- the next login asks again anyway.
+TimeoutStartSec=1h
+# Nothing to say is the overwhelmingly common case and is not a failure.
+SuccessExitStatus=0 1